Privacy Notice

CWT Studio operates this website and delivers consulting engagements from Ontario, Canada. For the purposes of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended (CCPA), we are the organization accountable for the personal information described here.

This notice covers the website and the forms on it. When we deliver an engagement, the signed engagement agreement governs how we handle information inside a client's own environment, and it takes precedence over this notice for that data.

Information you give us

• Name, work email address, company name and role, when you submit a form.
• The answers you select in the intake on the Systems Review page, and the email address you provide if you ask for the roadmap summary to be sent to you.
• Anything you type into a message field or into the booking form.

Information collected automatically

• IP address, browser and device type, and operating system.
• Pages requested, referring page, and timestamps.
• Interaction and page-view events, only after you turn on analytics in the cookie settings.

We do not ask for and do not want government identifiers, financial account numbers, health information, or any special category data through this website.

Each collection point on this site has one purpose, one basis, and one retention period.

Where retention runs from last contact, the clock restarts if you contact us again, and we delete earlier on request unless a legal or tax obligation requires us to keep a record.

We use service providers to run the site and deliver what you ask for. Each one is bound by contract to process personal information only on our instructions. The current list is maintained on the subprocessors page.

We are based in Canada. Several of our providers store and process data in the United States, and hosting and content delivery run on a global edge network. Personal information may therefore be accessible to authorities in those jurisdictions under their laws.

For transfers out of the EU, EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum where applicable, in our agreements with those providers. Under PIPEDA, we remain accountable for personal information transferred to a provider for processing.

Analytics and any advertising measurement are off until you turn them on, while necessary storage that makes the site work is always active. The full inventory, and the control to change your choice, is on the cookie notice.

Under Canada's Anti-Spam Legislation, we send commercial email only where you have given express consent or where an existing business relationship permits it. Every commercial message identifies us and carries a working unsubscribe link. Transactional messages, such as the roadmap summary you requested or a reply to your inquiry, are not marketing and are sent because you asked for them.

Withdrawing consent takes effect on receipt and no later than 10 business days, and it does not affect messages you have separately asked us to send.

We disclose personal information only in these situations:

• Service providers. The providers listed above, for the purposes listed beside them.
• Legal requirement. Where we are compelled by a lawful order, or where disclosure is required to establish or defend a legal claim.
• Business transfer. In connection with a merger, acquisition or sale of assets, where the recipient is bound to honour this notice.
• With your direction. Where you ask us to share something with a named party.

We do not disclose client engagement material to anyone outside the engagement without the client's written direction.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under the CCPA. We have not done so in the preceding 12 months. There is nothing to opt out of on that front, and we do not discriminate against anyone who exercises a privacy right.

The roadmap summary produced by the intake is generated by fixed rules from the answers you select. It is not a decision about you, it has no legal or economic effect, and a person reviews the situation before any engagement is scoped.

Our internal use of AI tooling, and the limits on it, is described in the AI responsibility policy.

Data in transit is encrypted with TLS. Database access is restricted by row-level access rules, form endpoints validate and rate-limit input, and administrative access requires authentication. Details are in the security overview. No system can be guaranteed secure, and we do not claim otherwise.

If a breach of security safeguards creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and we keep a record of breaches as PIPEDA requires. Where the GDPR applies, we notify the competent supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals.

Subject to the limits in applicable law, you can ask us to do any of the following, and we respond within 30 days:

• Confirm what we hold about you and provide a copy.
• Correct information that is inaccurate or incomplete.
• Delete information we no longer need to keep.
• Restrict or object to a particular use.
• Provide your information in a portable, machine-readable format.
• Withdraw consent, including consent to marketing email or analytics.

Send the request to shannon@thecwtstudio.com. We may ask you to confirm the email address on file before acting, which is a safeguard against someone else requesting your data. An authorized agent may act for you with written authority.

• Privacy Officer: shannon@thecwtstudio.com
• Organization: CWT Studio
• Location: Ontario, Canada

If our response does not resolve your concern, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. If you are in the EU, EEA or UK, you can complain to your local supervisory authority. If you are in California, you can contact the California Privacy Protection Agency.

This is a business-to-business service. It is not directed to anyone under 18 and we do not knowingly collect information from minors. If you believe a minor has submitted information, write to us and we will delete it.

When this notice changes we update the effective date at the top of the page. For a change that materially affects how we use information already collected, we obtain consent or give notice before the change applies to that information.